CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2011-4725
https://notcve.org/view.php?id=CVE-2011-4725
16 Dec 2011 — Multiple SQL injection vulnerabilities in the Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by login_up.php3 and certain other files. Múltiples vulnerabilidades de inyección SQL en el panel de administración del servidor de Parallels Plesk Panel 10.2.0_build1011110331.18 permiten a usuarios remotos ejecutar comandos SQL de su elección a través de datos de entrada modif... • http://xss.cx/examples/plesk-reports/plesk-redhat-el6-psa-10.2.0-build-1011110331.18-xss-sqli-cwe79-cwe89-javascript-injection-exception-example-poc-report-paros-burp-suite-pro-1.4.1.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 1%CPEs: 3EXPL: 0CVE-2011-4732
https://notcve.org/view.php?id=CVE-2011-4732
16 Dec 2011 — The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving account/power-mode-logout and certain other files. NOTE: it is possible that only clients, not the Plesk product, could be affected by this issue. El panel de administración del servidor de Parallels Plesk Panel 10.2.0_build1011110331.18 om... • http://xss.cx/examples/plesk-reports/plesk-redhat-el6-psa-10.2.0-build-1011110331.18-xss-sqli-cwe79-cwe89-javascript-injection-exception-example-poc-report-paros-burp-suite-pro-1.4.1.html •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2011-4754
https://notcve.org/view.php?id=CVE-2011-4754
16 Dec 2011 — Multiple cross-site scripting (XSS) vulnerabilities in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by smb/app/available/id/apscatalog/ and certain other files. Multiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en Parallels Plesk Small Business Panel 10.2.0. Permiten a atacantes remotos inyectar codigo de script web o código HTML de su elección a través de entrada modif... • http://xss.cx/examples/plesk-reports/plesk-10.2.0.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2011-4756
https://notcve.org/view.php?id=CVE-2011-4756
16 Dec 2011 — Parallels Plesk Small Business Panel 10.2.0 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by cookies used by domains/sitebuilder_edit.php and certain other files. Parallels Plesk Small Business Panel 10.2.0 no incluye el atributo HTTPOnly de una cabecera Set-Cookie para una cookie, lo que facilita a atacantes remotos obtener información confidenci... • http://xss.cx/examples/plesk-reports/plesk-10.2.0.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2011-4849
https://notcve.org/view.php?id=CVE-2011-4849
16 Dec 2011 — The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, as demonstrated by cookies used by help.php and certain other files. El panel de control de Parallels Plesk Panel 10.4.4_build20111103.18 no habilita la opción "secure flag" para cookies de una sesión https, lo que facilita a atacantes remotos capturar esta c... • http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 0CVE-2011-4761
https://notcve.org/view.php?id=CVE-2011-4761
16 Dec 2011 — Parallels Plesk Small Business Panel 10.2.0 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving domains/sitebuilder_edit.php and certain other files. NOTE: it is possible that only clients, not the SmarterStats product, could be affected by this issue. Parallels Plesk Small Business Panel 10.2.0 omite el parámetro charset de cabeceras Content-Type para determinados recurso... • http://xss.cx/examples/plesk-reports/plesk-10.2.0.html •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 0CVE-2011-4768
https://notcve.org/view.php?id=CVE-2011-4768
16 Dec 2011 — The Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving Wizard/Edit/Modules/Image and certain other files. NOTE: it is possible that only clients, not the Plesk product, could be affected by this issue. La característica "Site Editor" (SiteBuilder) de Parallels Plesk Small Business Panel 1... • http://xss.cx/examples/plesk-reports/plesk-10.2.0-site-editor.html •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 0CVE-2011-4757
https://notcve.org/view.php?id=CVE-2011-4757
16 Dec 2011 — Parallels Plesk Small Business Panel 10.2.0 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms in smb/auth and certain other files. Parallels Plesk Small Business Panel 10.2.0 genera un campo de formulario de contraseña sin deshabilitar el autocompletado, lo que facilita a atacantes remotos evitar la autenticación accediendo a un ordenador desatentidi... • http://xss.cx/examples/plesk-reports/plesk-10.2.0.html • CWE-255: Credentials Management Errors •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2011-4851
https://notcve.org/view.php?id=CVE-2011-4851
16 Dec 2011 — The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms in server/google-tools/ and certain other files. El panel de control de Parallels Plesk Panel 10.4.4_build20111103.18 genera un campo de formulario de contraseña sin deshabilitar el autocompletado, lo que facilita a atacantes remotos e... • http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html • CWE-255: Credentials Management Errors •
CVSS: 10.0EPSS: 1%CPEs: 2EXPL: 0CVE-2011-4749
https://notcve.org/view.php?id=CVE-2011-4749
16 Dec 2011 — The billing system for Parallels Plesk Panel 10.3.1_build1013110726.09 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms on certain pages under admin/index.php/default. El sistema de tarificación de Parallels Plesk Panel 10.3.1_build1013110726.09 genera un campo de formulario de contraseña sin deshabilitar la opción de autocompletado, lo que facilita... • http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build1013110726.09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.html • CWE-255: Credentials Management Errors •